US 7227948 B2 Abstract An encryption apparatus for block data, comprises a first processing unit randomizing the block data in units of first portions obtained by dividing the block data, and a second processing unit diffusing the block data output from the first processing unit with respect to a second portion of the block data which is wider than the first portion. The first processing unit comprises first nonlinear processing units nonlinearly transforming the block data in units of the first portions. The second processing unit comprises a first linear diffusion processing unit linearly diffusing the second portion of the block data. At least one of the first nonlinear processing units comprises second nonlinear processing units nonlinearly transforming the block data in units of the first portions, and a second linear diffusion processing unit linearly diffusing the second portion of the block data.
Claims(18) 1. An encryption apparatus, comprising:
a plurality of stage sections connected in series, each of said plurality of stage sections comprising a diffusing unit configured to diffuse 128-bit block data and four first randomizing units, said four first randomizing units configured to receive input 128-bit plaintext block data at a first stage or 128-bit block data processed by a preceding stage at a second and subsequent stages, said four first randomizing units further configured to randomize four sets of 32-bit data obtained by dividing the 128-bit block data, and said diffusing unit is configured to diffuse the 128-bit block data obtained by coupling the four sets of 32-bit data output from said four randomizing units using a Maximum Distance Separable matrix;
four second randomizing units connected to a last stage of said plurality of stage sections and configured to randomize four sets of 32-bit data obtained by dividing the 128-bit block data; and
a first key adder connected to said four second randomizing units and configured to add 128-bit key data to 128-bit block data obtained by coupling the four sets of 32-bit data output from said four second randomizing units; wherein each of said stage sections further comprises
four second key adders configured to add 8-bit key data to four sets of 8-bit data obtained by dividing one of the four sets of 32-bit data,
four randomizing units configured to randomize outputs of said four second key adders by using an input/output table of 8-bits,
a diffusion unit configured to diffuse 32-bit data obtained by coupling four sets of 8-bit data output from said four randomizing units using said Maximum Distance Separable matrix, and
four third key adders configured to add 8-bit key data to four sets of 8-bit data obtained by dividing one of the four sets of 32-bit data and which are connected to said diffusion unit.
2. An encryption apparatus comprising:
a plurality of stage sections connected in series, each of said plurality of stage sections comprising a diffusing unit configured to diffuse 64-bit block data and two first randomizing units, said two first randomizing units configured to receive 64-bit plaintext block data at a first stage or 64-bit block data processed by a preceding stage at a second and subsequent stages, said two first randomizing units further configured to randomize two sets of 32-bit data obtained by dividing the 64-bit block data, and said diffusing unit configured to diffuse the 64-bit block data obtained by coupling the two sets of 32-bit data output from said two randomizing units using a Maximum Distance Separable matrix;
two second randomizing units connected to a last stage of said plurality of stage sections and configured to randomize two sets of 32-bit data obtained by dividing the 64-bit block data; and
a first key adder connected to said two second randomizing units and configured to add 64-bit key data to 64-bit block data obtained by coupling the two sets of 32-bit data output from said two second randomizing units;
wherein each of said stage sections further comprises
two second key adders configured to add 8-bit key data to two sets of 8-bit data obtained by dividing one of the two sets of 32-bit data,
two randomizing units configured to randomize outputs of said two second key adders by using an input/output table of 8-bits,
a diffusion unit configured to diffuse 32-bit data obtained by coupling two sets of 8-bit data output from said two randomizing units using said Maximum Distance Separable matrix, and
two third key adders configured to add 8-bit key data to two sets of 8-bit data obtained by dividing one of the two sets of 32-bit data and which are connected to said diffusion unit.
3. An encryption method, comprising:
dividing a data stream into plural 128-bit blocks of data;
running each of a first 128-bit input through a stage step, said stage step including,
randomizing by dividing the first 128-bit input into a first set of four 32-bit inputs,
dividing each of said first set of four 32-bit inputs into a corresponding first set of four 8-bit inputs,
applying a first 8-bit key data to each of said corresponding first set of four 8-bit inputs generating a corresponding set of four resultant first keyed 8-bit inputs,
passing said corresponding set of four resultant first keyed 8-bit inputs through a set of four S-boxes to generate a set of 8-bit S-box outputs,
diffusing by coupling said set of 8-bit S-box outputs into a Maximum Distance Separable (MDS) matrix to generate a second corresponding set of four 8-bit block input,
applying a second 8-bit key data to each of said second corresponding set of four 8-bit block input to generate a corresponding set of resultant second keyed 8-bit input,
passing said corresponding set of resultant second keyed 8-bit input through a second set of four S-boxes to generate a set of second corresponding 8-bit S-box output,
combining said set of second corresponding 8-bit S-box output into a second set of four 32-bit inputs,
diffusing by coupling said second set of four 32-bit inputs into said MDS matrix to generate a third set of four 32-bit inputs,
combining said third set of four 32-bit inputs to form a second 128-bit input which is repeated through the stage step as the first 128-bit block of data until said stage step is repeated three times to form a third 128-bit input; and
running said third 128-bit input through a last stage step, said last stage step including,
randomizing by dividing the third 128-bit input into a last stage first set of four 32-bit inputs,
dividing each of said last stage first set of four 32-bit inputs into a last stage corresponding first set of four 8-bit inputs,
applying a last stage first 8-bit key data to each of said last stage corresponding first set of four 8-bit inputs to generate a last stage corresponding set of four resultant first keyed 8-bit inputs,
passing said last stage corresponding set of four resultant first keyed 8-bit inputs through a third set of four S-boxes to generate a last stage set of 8-bit S-box outputs,
diffusing by coupling said last stage set of 8-bit S-box outputs into an MDS matrix to generate a last stage set of four 8-bit inputs,
applying a last stage second 8-bit key data to each of said last stage set of four 8-bit inputs to generate a last stage set of resultant second keyed 8-bit inputs,
passing said last stage set of resultant second keyed 8-bit inputs through a fourth set of four S-boxes to generate a last stage set of 8-bit S-box outputs,
combining said last stage set of 8-bit S-box outputs into a last stage second set of four 32-bit data inputs,
combining said last stage second set of four 32-bit data inputs into a fourth 128-bit input, and
applying a last stage 128-bit key data to said fourth 128-bit input to generate an encrypted data.
4. The encryption method according to
dividing said second set of four 32-bit data inputs into a subset of bit inputs, combining a corresponding 1-bit data of each corresponding bit position of each of a subset bit inputs and generating a new bit combination per each corresponding bit position of each of said subset bit inputs, and
passing said new bit combination through one of a plurality of MDS matrixes to generate a resultant bit combination corresponding to said each corresponding bit position to form the last stage input by combining said last stage input to form the 128-bit last stage input block data.
5. The method according to
6. The method according to
7. The method according to
8. The method according to
9. The method according to
10. The method according to
11. An encryption method, comprising:
dividing a data stream into plural 64-bit inputs; and
running each of a first 64-bit input through a stage step, said stage step including,
randomizing by dividing the first 64-bit input into a first set of two 32-bit inputs,
dividing each of said first set of two 32-bit inputs into a corresponding first set of two 8-bit inputs,
applying a first 8-bit key data to each of said corresponding first set of four 8-bit inputs to generating a corresponding set of four resultant first keyed 8-bit inputs,
passing said corresponding set of four resultant first keyed 8-bit inputs through a set of four S-boxes to generate a set of 8-bit S-box outputs,
diffusing by coupling said set of 8-bit S-box outputs into a Maximum Distance Separable (MDS) matrix to generate a second corresponding set of four 8-bit block input,
applying a second 8-bit key data to each of said second corresponding set of four 8-bit block input to generate a corresponding set of resultant second keyed 8-bit input,
passing said corresponding set of resultant second keyed 8-bit input through a second set of four S-boxes to generate a set of second corresponding 8-bit S-box output,
combining said set of second corresponding 8-bit S-box output into a second set of four 32-bit inputs,
diffusing by coupling said second set of four 32-bit inputs into said MDS matrix to generate a third set of two 32-bit inputs,
combining said third set of two 32-bit inputs to form a second 64-bit input which is repeated through the stage step as the first 64-bit input until said stage step is repeated two times to form a third 64-bit input; and
running said third 64-bit input through a last stage step, said last stage step including,
randomizing by dividing the third 64-bit input into a last stage first set of two 32-bit inputs,
dividing each of said last stage first set of two 32-bit inputs into a last stage corresponding first set of four 8-bit inputs,
applying a last stage first 8-bit key data to each of said last stage corresponding first set of four 8-bit inputs to generate a last stage corresponding set of four resultant first keyed 8-bit inputs,
passing said last stage corresponding set of four resultant first keyed 8-bit inputs through a third set of four S-boxes to generate a last stage set of 8-bit S-box outputs,
diffusing by coupling said last stage set of 8-bit S-box outputs into an MDS matrix to generate a last stage set of four 8-bit inputs,
applying a last stage second 8-bit key data to each of said last stage set of four 8-bit inputs to generate a last stage set of resultant second keyed 8-bit inputs,
passing said last stage set of resultant second keyed 8-bit inputs through a fourth set of four S-boxes to generate a last stage set of 8-bit S-box outputs,
combining said last stage set of 8-bit S-box outputs into a last stage second set of two 32-bit data inputs,
combining said last stage second set of two 32-bit data inputs into a fourth 64-bit input, and
applying a last stage 64-bit key data to said fourth 64-bit input to generate an encrypted data.
12. The encryption method according to
dividing said second set of two 32-bit data inputs into a subset of bit inputs, combining a corresponding 1-bit data of each corresponding bit position of each of a subset bit inputs and generating a new bit combination per each corresponding bit position of each of said subset bit inputs, and
passing said new bit combination through one of a plurality of MDS matrixes to generate a resultant bit combination corresponding to said each corresponding bit position to form the last stage input by combining said last stage input to form the 64-bit last stage input block data.
13. The method according to
14. The method according to
15. The method according to
16. The method according to
17. The method according to
18. The method according to
Description This application is based upon and claims the benefit of priority from the prior Japanese Patent Applications No. 2000-060482, filed Mar. 6, 2000; and No. 2000-210484, filed Jul. 11, 2000, the entire contents of both of which are incorporated herein by reference. The present invention relates to an encryption apparatus and method, and a decryption apparatus and method based on block encryption scheme, and an operating unit used in the encryption and decryption apparatuses. Typical fundamental structures of common key block encryption scheme include SPN type and Feistel type. For both structures, a design method for improving strength evaluation and resiliency against differential/linear cryptanalysis have been studied (reference [1] V. Rijmen, J. Daemen, B. Preneel, A. Bosselaers & E. Dcwin, The Cipher SHARK, Fast Software Encryption, LNCS 1039, 1996, reference [2] Kazumaro Aoki, Kazuo Ota, More Strict Evaluation of Maximum Mean Differential Probability and Maximum Mean Linear Probability, SCIS 96-4A, 1996, reference [3], Mitsuru Matsui, Block encryption scheme MISTY, ISEC 96-11, 1996). With the SPN structure, since the number of active S-boxes can be guaranteed, the number of stages for achieving the set strength can be easily determined (reference [1]). However, when the block size increases, and the parallelness of S-boxes becomes high, the process of diffusion layers becomes complicated, resulting in low speed. SQUARE/Rijndael Cipher can solve this problem (reference [4] J. Daemen, L. R. Knudsen & V. Rijmen, The Block encryption scheme Square, Fast Software Encryption, LNCS 1267, 1997, reference [5] J. Daemen & V. Rijmen, AES Proposal: Rijndael, http://www.east.kuleuven.ac.be/{tilde over ( )}rijmen/rijdael/ rijndaeldocV2.zip). In cipher of this type, 16 parallel S-boxes are arranged in a 4ื4 matrix to limit linear diffusion within a single column, thus reducing the processing load. By combining rearrangement of byte positions with linear diffusion, the influence of one byte in a given stage is diffused to all bytes two stages later, and 25 or more active S-boxes in four stages (robust against differential/linear cryptanalysis) are achieved. However, since bytes in a single column do not mix in the next stage, dedicated attack called SQUARE attack is present (reference [1], reference [5]). This results from achievement of both high strength and efficiency under the restriction of only one type of diffusion layers. The SPN structure allows easy estimation of the lower limit of the number of active S-boxes, and can be designed to guarantee high strength against differential/linear cryptanalysis. However, when the parallelness of S-boxes becomes higher with increasing block size of plaintext/ciphertext, the calculation cost of a coupling portion of diffusion layers becomes high. Also, uniform data diffusion cannot be attained depending on the design of diffusion layers. Accordingly, the present invention is directed to method and apparatus that substantially obviates one or more of the problems due to limitations and disadvantages of the related art. In accordance with the purpose of the invention, as embodied and broadly described, the invention is directed to an apparatus for encrypting block data, comprising a first processing unit configured to randomize the block data in units of first portions obtained by dividing the block data, and a second processing unit configured to diffuse the block data output from the first processing unit with respect to a second portion of the block data which is wider than the first portion. Also, in accordance with the present invention, there is provided an method of encrypting block data, comprising randomizing the block data in units of first portions obtained by dividing the block data, and diffusing the randomized block data with respect to a second portion of the block data which is wider than the first portion. According to the present invention, there is provided an apparatus for decrypting encrypted block data, comprising a first processing unit configured to randomize the encrypted block data in units of first portions obtained by dividing the encrypted block data, and a second processing unit configured to diffuse the encrypted block data output from the first processing unit with respect to a second portion of the encrypted block data which is wider than the first portion. According to the present invention, there is provided an article of manufacture comprising a computer usable medium having computer readable program code means embodied therein, the computer readable program code means comprising first computer readable program code means for causing a computer to randomize the encrypted block data in units of first portions obtained by dividing the encrypted block data, and second computer readable program code means for causing a computer to diffuse the encrypted block data output from the first processing unit with respect to a second portion of the encrypted block data which is wider than the first portion. According to the present invention, there is provided an arithmetic operation device for a block data encryption apparatus which device diffuses block data using a Maximum Distance Separable matrix, the device comprising: a multiplier configured to multiply corresponding bits of first portions obtained by dividing the block data and an element of the Maximum Distance Separable matrix without feeding back an overflow; a lookup table configured to store data indicating a relation between predetermined upper bits and a return word for adjusting the overflow; and an EX-OR circuit configured to read out the return word based on the predetermined upper bits and EX-OR the read return word and an output of the multiplier. According to the present invention, an encryption apparatus and method, and a decryption apparatus and method achieves uniform diffusion while suppressing calculation cost. A preferred embodiment of an encryption apparatus and method, and a decryption apparatus and method based on block encryption scheme, and an operating unit used in the encryption and decryption apparatuses according to the present invention will now be described with reference to the accompanying drawings. In the embodiment, nested (recursive) SPN encryption as a combination of local randomization (lower-level diffusion) and diffusion over the block width (higher-level diffusion) will be explained. In the following description, encryption will be mainly explained, and decryption will then be explained. Note that a decryption algorithm is an inverse transform of an encryption algorithm, and a key is a secret key common to encryption and decryption. The encryption system of this embodiment can be implemented by either hardware or software, and an arrangement example to be described below can be achieved as a functional block diagram of an encryption apparatus (decryption apparatus) or a functional module diagram of an encryption algorithm (decryption algorithm). As shown in According to such nested SPN structure, the branch number can be hierarchically guaranteed (hierarchy of the branch number), and the lower limit of the number of active S-boxes can also be easily guaranteed. In the nested SPN structure, strength evaluation can be easily made owing to its simple structure. In Moreover, all the nonlinear transformation modules This embodiment will be explained below taking 128-bit block encryption scheme equivalent to AES that uses 8-bit S-boxes as an example. Strength evaluation of block encryption scheme will be explained below. As an important measure for estimating the encryption strength of a given function f, the maximum differential probability/maximum linear probability is known. A maximum differential probability dp In general, it is hard to accurately obtain the maximum differential probability dp In this embodiment, the nested SPN structure is used as an encryption function. The characteristics of an SPS structure as the basic structure of the nested SPN structure will be explained below. Note that SPS indicates a three-layered structure of S-box and diffusion layers S and P like S-P-S. The SPS structure is regarded as the two-stage SPN structure. In the SPS structure, if θ(x) represents the output from the diffusion layer in response to input x, the branch number B with respect to differential cryptanalysis is defined by (see reference [1], reference [6], Hideo Shimizu & Toshinobu Kaneko, Diffusion Layer of Common Key Cipher, SCIS 99-72, 1999):
where w( ) is the Hamming distance using the bit length of an S-box as a code length. S-boxes connected to nonzero input/output differences will be referred to as active S-boxes. A structure obtained by connecting S-boxes to the input and output of a diffusion layer will be referred to as an SPS structure. If S-boxes are bijections, and at least one input bit to the SPS structure has nonzero difference, the number of active S-boxes is equal to or larger than the branch number (i.e., equal to or larger than B) according to the definition of the branch number. If p When M parallel S-boxes are used as S layers of the SPS structure, the branch number of diffusion layers that couple them is equal to or smaller than (M+1), and a linear transform in which the branch number satisfies (M+1) is called an MDS (Maximum Distance Separable) matrix. If the diffusion layers form an MDS matrix, the maximum differential characteristic probability of the SPS structure does not exceed an upper limit value p If a two-stage SPN structure is used as an S-box of a higher-level SPN structure, it is called an extended S-box (lower-level structure). Assume that M If both two types of higher-level and lower-level diffusion layers form MDS matrices, the number of active S-boxes does not become smaller than (M In As described above, in encryption scheme of this embodiment, 25(=5ื5) or more active S-boxes can be guaranteed by two stages. The maximum differential probability of each S-box is given by:
The differential characteristic probability in two stages is given by:
Likewise, the linear characteristic probability is given by:
Note that the SQUARE attack applied to conventional SQUARE/Rijndael encryption scheme exploits the characteristics in which when all 2 This embodiment will be described in detail below using an example of nested encryption scheme. An example of the arrangement of this embodiment will be described. The block length takes 128 bits as an example (of course, the present invention can be practiced for other block lengths). The key length takes 256 bits as an example (of course, the present invention can be practiced for other block lengths). A case wherein the key length=128 bits or 192 bits when the block length=128 bits will be described later. When a pair of a plurality of parallel extended S-boxes and a higher-level MDS (the final stage does not include any higher-level MDS, as will be described later) is counted as one stage, R represents the number of stages, and R=8 is used in an example. Note that the number of stages is basically not particularly limited. However, the actual number of stages can be appropriately set in consideration of security, computer resources, and the like, and it is more effective to set six or more stages, and more preferably, eight or more stages. In encryption of this embodiment, since a stage function includes two S-box layers, one stage corresponds to two stages in a normal structure. As for a higher-level MDS in the stage structure, some implementations based on different Galois fields will be explained (strength priority and speed priority examples will be described). Reference numeral The stage function In the example of Since two stages of SPN structures are embedded in one stage of the stage function An S-box will be explained below. Encryption of this example uses an 8-bit S-box defined by an input/output table. In the table of The characteristics of the S-box exemplified in maximum differential probability: 6/256 (theoretical minimum value=4/256) maximum linear probability: 22/256 (theoretical minimum value=16/256) algebraic order: 7-th order (maximum value of bijection function) Note that the S-box may use an arithmetic process in place of the input/output table. Each extended S-box (also called a lower-level structure) will be explained below. A higher-level structure as a stage function of encryption of this example will be described below. The simplest implementation of a higher-level MDS is to use the 32-bit wide output of an extended S-box as elements of GF(2 The four parallel MDS matrices can be sufficiently configured by the 4-bit width, and can be implemented using arithmetic operations over GF(2 In practice, intermediate configurations using GF(2 A higher-level MDS using GF(2 In this case, the inputs and outputs of an extended S-box are considered as elements of GF(2 A higher-level MDS using GF(2 In this case, 1-bit data at corresponding positions (the most significant bits are exemplified in A diffusion layer The four sets of 4-bit data as outputs are connected to corresponding positions of corresponding source 8-bit data. Eight MDS matrices ( These 4 (rows)ื4 (columns) MDS matrices guarantee the branch number=5. Since the individual MDS matrices are connected to different bit positions in S-boxes, the branch number=5 is guaranteed as a whole. By table lookup in units of S-box outputs at corresponding positions of extended S-boxes (also by arithmetic operations), efficient implementation that simultaneously processes eight MDS matrices can be made. If cyclic MDS matrices are used, an efficient process that combines EX-ORing in units of 32 bits and bit rotations in units of 8 bits can be performed. Based on the same idea as described above, processing may be performed in units of 2 bits at corresponding positions of 8-bit data, and four 4 (rows)ื4 (columns) MDS matrices (GF(2 In the above description, bits at corresponding positions are extracted and processed. Alternatively, bits at different positions may be (exclusively) extracted and processed. In The key scheduling part (key generator) will be explained below. In the example shown in When the key length is 256 bits, for example, the upper 128 bits are input to the linear diffusion layer Note that the location of the remainder adder Note that this S-box may be either the same as or different from that ( Furthermore, a constant to be EX-ORed with the input to each S-box may be a stage number dependent constant in An example of a method of generating different constants C The 128-bit additive constant C where └x┘ is a floor function and indicates an largest integer which is not larger than x. A combination of additive constants C Note that the initial state of each LFSR may be variable or fixed. In the former case, the initial state of each LFSR partially defines the key. In the latter case, only a decryption apparatus having the same initial state of each LFSR as that in the encryption apparatus can decrypt the ciphertext. According to the aforementioned key scheduling part, in each SP layer Therefore, according to the key scheduling part, the respective stages easily generates, i.e., diffuse random keys. Since different constants are used in units of stages, keys rarely match among stages (keys hardly match). Note that the key scheduling part may have another arrangement. An efficient linear diffusion device used in the diffusion part of block encryption scheme data having a large block length will be explained below. As shown in The coefficient storage unit The multiplier When the coefficient of the coefficient storage unit The carry return unit The EX-OR unit The function of the Galois field multiplier The product in the Galois field will be described below. In the following description, i and j upon calculating sum totals in Σ a Elements of GF(2 The product of two elements a=Σ a where p(x) is called a primitive polynomial of GF(2 In general, upon executing such operation, a multiplier using a multiplication table that searches for a product using a multiplier and multiplicand as tags is often used so as to attain high-speed processing. However, since both the multiplier and multiplicand can assume 2 This embodiment is basically similar to that method using the multiplication table, but when coefficients satisfy a given constraint condition, such table are implemented by much smaller storage size. In this constraint condition, coefficient b is a constant, and only lower order coefficients of given order t or less have nonzero coefficients (coefficients exceeding the t-th order are 0, and coefficients of the t-th order or less are 0 or 1). When given element a assumes an arbitrary element, a maximum of a 32-bit carry is generated, but when this constraint condition is satisfied, a t-bit carry at most is generated. The t-bit carry value is determined by the MSB (Most Significant Bits) within the upper t-bit range of multiplier a. The difference between multiplication over the Galois field and that considered as a normal polynomial is that when a carry to a coefficient of the 32nd-order or higher is generated as a product of binary values, contribution of that carry must be returned to coefficients of less than the 32nd-order by the primitive polynomial, but the carry return unit This return word are determined by coefficient b of (t+1) bits at most, upper t bits of multiplicand a, and a primitive polynomial. That is, the return word is given by (a[(k−t) . . . (k−1)]ืb)[(t+1) . . . 2t] mod p(x) where a[(k−t) . . . (k−1)] extracts terms from the (k−1)-th order to the (k−t)-th order from a. That is, the contents of the return word table of the carry return unit The return word table of the carry return unit The linear transformation section which is implemented using the aforementioned Galois field multiplier and calculates the linear transforms of data blocks of block encryption scheme will be described below. Linear transformation using an MDS matrix is known as a kind of linear transformation. The MDS matrix is an n (rows)ืn (columns) matrix in which a data block consists of a plurality of (n) words, and when each word has a k-bit length, it is considered as an element of a Galois field GF(2 However, in general, a matrix operation over the Galois field GF(2 In the arrangement shown in If m=n in EX-OR units In this way, multiplication shown in Note that the contents of the return word table of the carry return unit An MDS matrix generation section (or random generation algorithm) for generating an MDS matrix (especially, higher-level MDS) used in the encryption system of the present invention will be explained below. The element generator In order to generate matrix elements, various methods such as a method of generating and using random numbers, a method of using control variable values of multiple loops, and the like are available. The small determinant calculation unit If all 1st-order small determinants are nonzero, 2nd-order small determinants are similarly checked (steps S The aforementioned process is repeated up to nth-order small determinants (steps S When the MDS matrix obtained in step S Note that even if all elements of the MDS matrix obtained in step S In the sequence shown in A method of obtaining MDS matrices so that both the MDS matrix used in encryption and that used in decryption as the inverse matrix of the former matrix satisfy a condition that only lower t bits are nonzero will be explained below. As in the above example, the element generator The inverse matrix generator The inverse matrix discrimination unit If only lower t bits of all elements are nonzero (step S If at least one element is found to have nonzero lower t bits (step S When the MDS matrix generated in step S Upon generating an MDS matrix, an MDS matrix in which elements having identical values are not present in identical rows (in an n (rows)ืn (columns) MDS matrix, the (i Using a linear transformation section that selects an MDS matrix in which elements having identical values are not present in a single row as a linear transformation section of block encryption scheme data, the probability that differential values of input words cancel each other are reduced. On the other hand, an MDS matrix in which the sum of elements in a single row is not 1 or 0 may be generated. In this case, the same effect are obtained. A method of improving security by selecting (or optimizing) the combination of S-box and lower-level MDS and, more particularly, a design method of a combination of S-box and lower-level MDS which can guarantee that the maximum differential characteristic probability becomes better than the theoretical worst example, will be described below. Since MDS guarantees only the branch number B, if p represents the maximum differential probability of S-boxes, the maximum differential characteristic probability is p As security evaluation schemes of an encryption algorithm, differential cryptanalysis and linear cryptanalysis are known, and they have duality. Paying attention to differential cryptanalysis, the security of S-boxes is specified by the probability that the input and output have differential correlation, and is higher with decreasing probability. In the encryption algorithm, the security are improved as a larger number of S-boxes with a smaller differential probability are combined. As an efficient coupling method of S-boxes, a linear transformation section has been conventionally proposed. The linear transformation section calculates the linear transform of data having a given block length, and is used as a component of an encryption apparatus (and a decryption apparatus). Linear transformation using an MDS matrix is known as a kind of linear transformation. An MDS matrix defines linear transformation to n words when a data block is made up of a plurality of (n) words, and guarantees (n+1) or more nonzero input/output words. However, since an S-box has a plurality of candidate values such as 6/256, 4/256, 2/256, and the like as a differential probability, an MDS in which each of (n+1) probabilities is 4/256 can assure higher security than an MDS in which each of (n+1) probabilities is 6/256. Conventionally, the securities of the S-box and MDS are individually evaluated as sole building elements. In this embodiment, an example of a device for verifying the synergism of the S-box and MDS will be described. A plurality of S-box candidates and a plurality of lower-level MDS candidates are generated (steps S One of the S-box candidates is selected (step S As will be described later, a maximum difference of effective (active) S-boxes is calculated (step S If such difference is included (step S On the other hand, if no such difference is included (step S In The actual processes in steps S In the example of the extended S-box (1) When one S-box (2) When only two S-boxes (3) When only two S-boxes (4) When one S-box The plurality of verification processes may be sequentially performed, or all or some of them may be parallelly performed. If one of the plurality of verification processes is not successful, all the subsequent verification processes may be canceled for that combination of S-box and lower-level MDS, and it may be determined that verification is not successful. In the example of the sequence shown in The encryption apparatus has been explained. An decryption apparatus will be explained below. The decryption apparatus has a structure obtained by reversing that of the encryption apparatus (the same key is used). In The input/output table of each S-box In Reference numeral The input/output table of each S-box, lower-level MDS matrix, higher-level MDS matrix used in the key scheduling part shown in Assume that a decryption key input K′ in In this case as well, various variations of the locations where the stage number dependent constants C The example of 128-bit block encryption scheme equivalent to AES, which uses 8-bit S-boxes has been described as an application example of nested (recursive) SPN encryption as a combination of local diffusion (lower-level diffusion) and diffusion over the block width (higher-level diffusion). Another embodiment will be described using an example of 64-bit block encryption scheme equivalent to AES, which uses 8-bit S-boxes (portions which differ since 64 bits are used in place of 128 bits will be mainly explained). An example of the arrangement of the second embodiment of a 64-bit block encryption scheme encryption apparatus/decryption apparatus or encryption algorithm/decryption algorithm to be described below corresponds to a case wherein two parallel nonlinear transformation modules As in 128-bit block encryption scheme mentioned above, 64-bit block encryption scheme can improve resiliency against attacks. An example of the hierarchical structure of the data diffusion part of nested encryption is the same as that shown in The block length is 64 bits. The key length is 128 bits as an example (of course, the present invention are practiced for other block lengths). A case wherein the key length=64 bits or 96 bits when the block length=64 bits will be described later. As an example of the number of stages (a pair of a plurality of parallel extended S-boxes and a higher-level MDS (the final stage does not include any higher-level MDS, as will be described later) is counted as one stage), R=6 is used. Note that the number of stages is basically not particularly limited. However, the actual number of stages are appropriately set in consideration of security, computer resources, and the like, and it is more effective to set six or more stages. In encryption of this embodiment, since a stage function includes two S-box layers, one stage corresponds to two stages in a normal structure. As for a higher-level MDS in the stage structure, some implementation examples based on Galois fields will be explained. Reference numeral The stage function has a structure in which two parallel 32-bit processing subblocks (extended S-boxes) In the example of Since two stages of SPN structures are embedded in one stage of stage function, and key addition is made at the end of the process, the bit length of an extended key is 2ื64ืR+64=64(2R+1). When R=6, the bit length is 128ื13 bits. Each S-box can use either an input/output table or arithmetic process, as described above. An example of the input/output table of the 8-bit S-box are the same as that shown in An example of the internal arrangement of the extended S-box The higher-level structure as the stage function of encryption of this example will be explained below. As for the arrangement of the higher-level MDS, methods using GF(2 The higher-level MDS using GF(2 In this case, 1-bit data at corresponding positions (the most significant bits are exemplified in A diffusion layer The two sets of 4-bit data as outputs are connected to corresponding positions of corresponding source 8-bit data. Eight MDS matrices ( By table lookup in units of S-box outputs at corresponding positions of extended S-boxes (also by arithmetic operations), efficient implementation that simultaneously processes eight MDS matrices are made. If cyclic MDS matrices are used, an efficient process that combines EX-ORing in units of 32 bits and bit rotations in units of 8 bits are performed. Note that -
- 1st row, 1st column=5, 1st row, 2nd column=7
- 2nd row, 1st column=A, 2nd row, 2nd column=B
A corresponding higher-level MDS matrix for the decryption apparatus is described by: -
- 1st row, 1st column=C, 1st row, 2nd column=A
- 2nd row, 1st column=5, 2nd row, 2nd column=B
Note that the former matrix may be used for decryption, and the latter may be used for encryption. Also, a matrix obtained by substituting rows, substituting columns, and arbitrarily transposing in an arbitrary MDS matrix may be used. Furthermore, other higher-level MDS matrices may be used. This higher-level MDS diffusion layer are implemented by software for executing transformation by means of a matrix arithmetic operations or input/output transformation table, but may also be implemented by hardware (an actual circuit formed on, e.g., a semiconductor substrate). In order to implement the higher-level MDS using an actual circuit, a line connection pattern equivalent to an MDS matrix are used. More specifically, in each of the diffusion layers After coupling processes by EX-ORing portions corresponding to products of the matrix, coupling processes by EX-ORing portions corresponding the sums of products of the matrix are performed. Alternatively, all such coupling processes by EX-ORing may be performed simultaneously, or may be divisionally performed in a plurality of processes. Also, the following procedure may be taken. That is, desired line connection patterns are selected from the line connection pattern group shown in Also, expressions other than line connection expressions (line connection patterns) of multiplication over GF(2 This method are applied not only to the second embodiment but also to 128-bit block encryption scheme of the first embodiment mentioned above. Renormalization will be described below. Fan-in of the MDS diffusion layer will be explained. In the line connection patterns shown in A total S of fan-in values of line connection patterns of the MDS diffusion layer will be examined below. In the example shown in As a method of reducing S, a renormalization scheme is known. This scheme can reduce the circuit volume (calculation volume upon making matrix calculations). In order to perform renormalization, pre-processing circuits Each pre-processing circuit -
- 1st row, 1st column=1, 1st row, 2nd column=4
- 2nd row, 1st column=2, 2nd row, 2nd column=9
In Higher-level diffusion in As a method of obtaining a common factor and a matrix at that time upon making renormalization, for example, matrices that can attain higher-level diffusion equivalent to that of a matrix obtained without renormalization are obtained using common factors as parameters, and their fan-in values are evaluated to select a matrix to be adopted. Note that respective S-boxes may or may not be constrained to have an identical common factor. Upon implementation by renormalization for respective S-boxes using a common factor=B in a matrix described by: -
- 1st row, 1st column=C, 1st row, 2nd column=A
- 2nd row, 1st column=5, 2nd row, 2nd column=B
- a higher-level MDS matrix is described by:
- 1st row, 1st column=9, 1st row, 2nd column=4
- 2nd row, 1st column=2, 2nd row, 2nd column=1
of course, this method can also be applied to 128-bit block encryption scheme mentioned above. Note that wiring and layouts exemplified above indicate theoretical relationships, and actual wiring and layouts have a degree of freedom in design. Eight portions The encryption and decryption apparatuses are arranged in the same way (they have only an inverse transform relationship). Based on the same idea as described above, processing may be performed in units of 2 bits at corresponding positions of 8-bit data, and four 2 (rows)ื2 (columns) MDS matrices (GF(2 In the above description, bits at corresponding positions are extracted and processed. Alternatively, bits at different positions may be (exclusively) extracted and processed. As in the example shown in The aforementioned arrangement examples can also be applied to 128-bit block encryption scheme mentioned above. As in the above description, in All the higher-level MDS matrices need not have the same internal arrangement, and some of them may have different arrangements. The same applies to lower-level MDS matrices and the input/output tables of S-boxes. For example, the first input stage and last output stage may have internal arrangements different from those of the intermediate stages. Note that an arrangement for substituting bit positions of a plurality of S-boxes belonging to identical extended S-boxes (or inserting such circuit) at the input and output side of each higher-level MDS is also available. In addition, various other variations are available. Of course, the arrangement of the higher-level MDS described so far are applied to encryption and decryption apparatuses having various variations. The key scheduling part (key generator) will be explained below. In the example shown in When the key length is 128 bits, for example, the upper 64 bits are input to the linear diffusion layer Note that the location of the remainder adder An example of the arrangement of each nonlinear transformation layer An example of a method of generating different constants C The 64-bit additive constant C A combination of additive constants C Note that the initial state of LFSR may be variable or fixed. In the former case, the initial state of LFSR partially defines the key. In the latter case, only a decryption apparatus having the same initial state of LFSR as that in the encryption apparatus can decrypt the ciphertext. According to the aforementioned key scheduling part, in the nonlinear transformation layer, when 1 bit of the input has changed, the S-boxes can spread that change to 8 bits, and the lower-level MDS can spread the change to 32 bits. Furthermore, in the linear diffusion layer, since the higher-level MDS largely diffuses the output from the nonlinear transformation layer of the previous state, a 1-bit difference are spread to the 64-bit width. Therefore, according to the key scheduling part, the respective stages can easily generate, i.e., diffuse random keys. Since different constants are used in units of stages, keys rarely match among stages (keys nearly do not match). Note that the key scheduling part may have another arrangement. Note that the linear diffusion device and Galois field multiplier that have been explained with reference to The MDS matrix generation section (or random generation algorithm) that has been explained with reference to Of course, the design method of a combination of S-box and MDS that has been explained with reference to The decryption apparatus will be explained below. The decryption apparatus basically has a structure obtained by reversing that of the encryption apparatus (the same key is used). An example of the arrangement corresponding to the lower-level structure (see In The input/output table of each S-box (see In Reference numeral The input/output table of each S-box, lower-level MDS matrix, and higher-level MDS matrix used in the key scheduling part shown in Assume that a decryption key input K′ in In this case as well, various variations of the locations where the stage number dependent constants C In the above description, 128-bit block encryption scheme and 64-bit block encryption scheme have been exemplified, but the present invention are applied to block encryption scheme of other bit lengths. The hardware arrangement and software arrangement of this embodiment will be explained below. The encryption and decryption apparatuses of this embodiment are implemented by either hardware or software. Upon software implementation, this embodiment are applied to a computer readable recording medium which records a program which implements the encryption or decryption apparatus and makes a computer execute predetermined means (or makes a computer function as predetermined means, or makes a computer implement predetermined functions). Upon hardware implementation, the encryption or decryption apparatus are formed as a semiconductor device. When an encryption or decryption apparatus to which the present invention is applied is constructed, or when an encryption or decryption program is prepared, all blocks or modules exemplified in In case of software implementation, multi-processors may be used to execute parallel processes, thus achieving high-speed processing. Note that an apparatus which has an encryption function but no decryption function, an apparatus which has a decryption function but no encryption function, or an apparatus which has both the encryption and decryption functions are constructed. Likewise, a program which has an encryption function but no decryption function, a program which has a decryption function but no encryption function, or a program which has both the encryption and decryption functions are prepared. Applications of this embodiment to systems will be explained below. The encryption system of this embodiment are basically applied to every systems. For example, as shown in For example, as shown in For example, as shown in Also, the present invention are applied to various other systems. Note that the arrangements described in this embodiment are merely examples, and do not exclude other arrangements, and other arrangements obtained by replacing some components of the exemplified arrangement by other ones, omitting some components of the exemplified arrangement, adding other functions to the exemplified arrangement, or combining them are also available. Also, another arrangement theoretically equivalent to the exemplified arrangement, another arrangement including portions theoretically equivalent to the exemplified arrangement, another arrangement theoretically equivalent to principal part of the exemplified arrangement, and the like are available. Furthermore, another arrangement that achieves the same or similar objects as or to that of the exemplified arrangement, another arrangement that can provide the same or similar effects as or to those of the exemplified arrangement, and the like are available. Additional advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described herein. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. Patent Citations
Non-Patent Citations
Referenced by
Classifications
Legal Events
Rotate |